Blind Eagle JC-46 AsyncRAT C2 DuckDNS domain query

Duo Tech@duotech

•updated Jul 23, 2026•1•0•1

Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.